Researchers Link HQ Corps SIXBOI Dump to 199,109 Stolen Credentials

HEROIC analysts traced a combolist named "200009 HQ Corps SIXBOI" to a Telegram upload from January 2025. The file contains 199,109 records, each pairing an email address with a plaintext password and an associated URL, another entry in the "HQ," or high-quality, category of combolists sold on Telegram.

Why the HQ Corps SIXBOI Leak Is Dangerous

Nearly 200,000 credential pairs give attackers substantial reach for automated login attempts. The "HQ" branding suggests the seller claims these credentials have been filtered for accuracy, meaning a higher share of this list is likely to work against real accounts compared to raw, unverified data.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A dump of nearly 200,000 records feeds directly into credential stuffing operations, where automated tools test each pair against dozens of popular login pages. Anyone whose credentials appear in this file faces a real risk of account takeover, and from there, financial fraud or identity theft if the compromised account holds personal or payment information.

How Corps-Style Combolists Like This Are Sold

Sellers on Telegram often brand combolists with corp-style names and numbers, like "200009 HQ Corps SIXBOI," to build a sense of product identity across a catalog of files. These names rarely reflect the original source of the data, which is usually a blend of older breaches and stealer log output repackaged for sale.

Check If You Are Affected

With nearly 200,000 credentials in circulation, it is worth taking a minute to check your own exposure. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, so you can quickly find out if your email address is part of this leak.